Spring session and spring data redis for non sticky session replication across servers

Hi Rob,

I'm not sure whether this is an issue that need to be created here or not Didn't find any other place and hence posting it here.

We are trying to implement a session replication strategy for our tomcat containers. The application is built on spring web and spring security. We use spring managed CSRF too. Our thinking was that use spring session, spring-data-redis to store the session to redis and use the session from redis by tomcat containers. We were able to store the session to redis successfully. But subsequently, we were not able to proceed in the right direction. The issues we have are:

1. How to identify the right session for a given user request? I read somewhere that an invocation of httpRequest.getSession() transparently refer the redis backed spring session, but the session was not having all those information persisted into redis. I'm using a custom filter to get the session before the request is serviced to read the spring security related information
2. When I use a redis desktop client and look at the HEX coded information I can see a lot much information on SPRING_SECURITY_CONTEXT, but from the session when I retrieve the security context, it just had the UsernamePasswordAuthenticationToken alone. Does it look like I need to write my won deserializers for the rest of the information? How do I do that if that is the case? The HEX format of the spring security context from redis look like below:

\xAC\xED\x00\x05sr\x00=org.springframework.security.core.context.SecurityContextImpl\x00\x00\x00\x00\x00\x00\x01@\x02\x00\x01L\x00\x0Eauthenticationt\x002Lorg/springframework/security/core/Authentication;xpsr\x00Oorg.springframework.security.authentication.UsernamePasswordAuthenticationToken\x00\x00\x00\x00\x00\x00\x01@\x02\x00\x02L\x00\x0Bcredentialst\x00\x12Ljava/lang/Object;L\x00\x09principalq\x00~\x00\x04xr\x00Gorg.springframework.security.authentication.AbstractAuthenticationToken\xD3\xAA(nGd\x0E\x02\x00\x03Z\x00\x0DauthenticatedL\x00\x0Bauthoritiest\x00\x16Ljava/util/Collection;L\x00\x07detailsq\x00\x00\x04xp\x01sr\x00&java.util.Collections$UnmodifiableList\xFC\x0F%1\xB5\xEC\x8E\x10\x02\x00\x01L\x00\x04listt\x00\x10Ljava/util/List;xr\x00,java.util.Collections$UnmodifiableCollection\x19B\x00\x80\xCB^\xF7\x1E\x02\x00\x01L\x00\x01cq\x00~\x00\x06xpsr\x00\x13java.util.ArrayListx\x81\xD2\x1D\x99\xC7a\x9D\x03\x00\x01I\x00\x04sizexp\x00\x00\x00\x04w\x04\x00\x00\x00\x04sr\x00Borg.springframework.security.core.authority.SimpleGrantedAuthority\x00\x00\x00\x00\x00\x00\x01@\x02\x00\x01L\x00\x04rolet\x00\x12Ljava/lang/String;xpt\x00\x09HostAdminsq\x00~\x00\x0Et\x00\x0EDI_Integrationsq\x00~\x00\x0Et\x00\x0DDI_Dispatchersq\x00~\x00\x0Et\x00\x09DI_Driverxq\x00~\x00\x0Dppsr\x00&com.company.mdm.security.MDMUserDetailsc\xBCx\x96/\xCFe\x02\x00\x01L\x00\x05_usert\x00!Lcom/company/mdm/domain/user/User;xr\x00 com.company.security.LoginContext\x00\x00\x00\x00\x00\x00\x00\x01\x02\x00\x12Z\x00\x14_isAccountNonExpiredZ\x00\x13_isAccountNonLockedZ\x00\x0F_isAppStoreUserZ\x00\x18_isCredentialsNonExpiredZ\x00\x0A_isEnabledZ\x00\x0AenrollmentL\x00\x0C_authoritiesq\x00\x00\x06L\x00\x0A_companyIdt\x00\x13Ljava/lang/Integer;L\x00\x0B_dateFormatq\x00~\x00\x0FL\x00\x07_localeq\x00~\x00\x0FL\x00\x09_passwordq\x00~\x00\x0FL\x00\x07_secLvlq\x00~\x00\x0FL\x00\x09_timeZoneq\x00~\x00\x0FL\x00\x08_tokenIdq\x00~\x00\x0FL\x00\x07_userIdq\x00~\x00\x1BL\x00\x0B_userLocalet\x00\x12Ljava/util/Locale;L\x00\x09_userNameq\x00~\x00\x0FL\x00\x0BcompanyCodeq\x00~\x00\x0Fxp\x01\x01\x00\x01\x01\x00sq\x00~\x00\x0C\x00\x00\x00\x04w\x04\x00\x00\x00\x04q\x00~\x00\x10q\x00~\x00\x12q\x00~\x00\x14q\x00~\x00\x16xsr\x00\x11java.lang.Integer\x12\xE2\xA0\xA4\xF7\x81\x878\x02\x00\x01I\x00\x05valuexr\x00\x10java.lang.Number\x86\xAC\x95\x1D\x0B\x94\xE0\x8B\x02\x00\x00xp\x00\x00\x00\x01t\x00\x19MM/dd/yyyy hh:mm:ss aaa zt\x00\x05en-USt\x00,55hBiwOi5AcBPYk1Uh5cpyt7WeyOS+ghoBtDWFxmLfE=pt\x00\x09GMT-05:00psq\x00~\x00\x1F\x00\x00\x00\x01sr\x00\x10java.util.Locale~\xF8\x11`\x9C0\xF9\xEC\x03\x00\x06I\x00\x08hashcodeL\x00\x07countryq\x00~\x00\x0FL\x00\x0Aextensionsq\x00~\x00\x0FL\x00\x08languageq\x00~\x00\x0FL\x00\x06scriptq\x00~\x00\x0FL\x00\x07variantq\x00~\x00\x0Fxp\xFF\xFF\xFF\xFFt\x00\x02USt\x00\x00t\x00\x02enq\x00~\x00_q\x00~\x00_xt\x00\x05admint\x00\x08NUVZQAINsr\x00\x1Fcom.company.mdm.domain.user.User\xB1l\xB4wgCO\x0F\x02\x00\x07L\x00\x06dobStrq\x00~\x00\x0FL\x00\x08fullNameq\x00~\x00\x0FL\x00\x0DlicenseExpStrq\x00~\x00\x0FL\x00\x06loadIdq\x00~\x00\x1BL\x00\x14numberOfLoadAssignedq\x00~\x00\x1BL\x00\x11openLoadsAssignedt\x00\x13Ljava/lang/Boolean;L\x00\x06statusq\x00~\x00\x0Fxppt\x00\x0Ccompany Adminppppp

1. Is it the right approach to use spring session together wth spring-data-redis for this purpose or use spring session and go with a stateless architecture where we don't really worry about the http session at all.

The kind of configurations that I have are given below:

web.xml:

     <filter>
    <filter-name>springSessionRepositoryFilter</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSessionRepositoryFilter</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>REQUEST</dispatcher>
    <dispatcher>ERROR</dispatcher>
    <dispatcher>ASYNC</dispatcher>
</filter-mapping>

This filter is before the spring security filter.

jedisContext.xml:

  <bean class="org.springframework.session.data.redis.config.annotation.web.http.RedisHttpSessionConfiguration" />
 <bean class="org.springframework.web.filter.DelegatingFilterProxy">
   <constructor-arg>
    <bean class="org.springframework.session.web.http.SessionRepositoryFilter">
        <constructor-arg ref="sessionRepository"/>
    </bean>
   </constructor-arg>
 </bean>

We use the following versions:
Spring version: 4.3.0.RELESE, spring security version: 3.2.9.RELEASE
Spring session version: 1.2.1.RELEASE, Spring session data redis version: 1.7.1.RELEASE

Thanks in advance
Sethukumar

Start with web.xml and jedisContext.xml, then trace how the SessionRepositoryFilter is registered relative to Spring Security. Reproduce the Redis-backed session and security-context behavior with the listed Spring Session 1.2.1 and Spring Security 3.2.9 versions; done means the supported configuration and persistence behavior are documented or a concrete defect is isolated.